資安事件新聞週報 2020/4/6 ~ 2020/4/10






資安事件新聞週報 2020/4/6 ~ 2020/4/10

1.重大弱點漏洞/後門/Exploit/Zero Day
Safari漏洞讓惡意網站冒充Zoom、Skype存取iPhone或Mac電腦相機
https://www.ithome.com.tw/news/136767

Palo Alto PAN-OS 多個漏洞
https://security.paloaltonetworks.com/PAN-SA-2020-0002
https://security.paloaltonetworks.com/CVE-2020-1990
https://security.paloaltonetworks.com/CVE-2020-1992

Mozilla緊急修補兩個已被開採的Firefox零時差漏洞
https://www.ithome.com.tw/news/136796

Mozilla Firefox 修復可能遭遠端執行任意程式碼之 0-day 漏洞
https://www.twcert.org.tw/tw/cp-104-3503-c4955-1.html

全球仍有35萬個Exchange伺服器尚未修補CVE-2020-0688漏洞
https://www.ithome.com.tw/news/136800

時間緊迫,公網上存在35萬台Microsoft Exchange 服務器還未修復早在2月披露的漏洞(CVE-2020-0688)
https://blog.rapid7.com/2020/04/06/phishing-for-system-on-microsoft-exchange-cve-2020-0688/

HP電腦使用8年的技術支援軟體含有多項安全漏洞,即使新版也仍有漏洞未補完
https://www.ithome.com.tw/news/136770

agios XI 多個安全漏洞
https://nosec.org/home/detail/4432.html

Tomcat 爆出高危漏洞
https://segmentfault.com/a/1190000022268969

8000餘未受保護的Redis 伺服器可遭任意訪問
https://blog.trendmicro.com/trendlabs-security-intelligence/more-than-8000-unsecured-redis-instances-found-in-the-cloud/

Zoom Client for Meetings CVE-2020-11469
https://nvd.nist.gov/vuln/detail/CVE-2020-11469

Zoom Rushes Patches for Zero-Day Vulnerabilities
https://www.bankinfosecurity.com/zoom-rushes-patches-for-zero-day-vulnerabilities-a-14049

Apache HTTP Server CVE-2020-1934
https://nvd.nist.gov/vuln/detail/CVE-2020-1934

Apache HTTP Server 2.4 vulnerabilities
https://httpd.apache.org/security/vulnerabilities_24.html

MISP 安全漏洞
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11458

Nexus Repository Manager遠程代碼執行漏洞
https://nosec.org/home/detail/4427.html

Nexus Repository CVE-2020-10199
https://nvd.nist.gov/vuln/detail/CVE-2020-10199

CVE-2020-10199 Nexus Repository Manager 3 - Remote Code Execution - 2020-03-31
https://support.sonatype.com/hc/en-us/articles/360044882533

CVE-2020-11444 Nexus Repository Manager 3 - Improper Access Controls - 2020-04-02
https://support.sonatype.com/hc/en-us/articles/360046133553

Nexus Repository Manager(CVE-2020-10199/10204)漏洞分析及回顯利用方法的簡單討論
https://www.cnblogs.com/magic-zero/p/12641068.html

C 語言漏洞最嚴重,PHP 最易受攻擊,程序員該怎麼寫代碼
https://www.chainnews.com/zh-hant/articles/470489068306.htm

US Government Advises Everyone to Upgrade Google Chrome as Soon as Possible
https://bit.ly/2JI5AUW

Fortinet Security Researcher Discovers Multiple Critical Vulnerabilities in Adobe Photoshop
https://www.fortinet.com/blog/threat-research/fortinet-security-researcher-discovers-multiple-critical-vulnerabilities-in-adobe-photoshop.html

JVNVU#91401524 Periscope 製 BuySpeed におけるクロスサイトスクリプティングの脆弱性
https://jvn.jp/vu/JVNVU91401524/

JVN#56890693 Joomla! 用プラグイン「AcyMailing」における任意のファイルをアップロードされる脆弱性
https://jvn.jp/jp/JVN56890693/

JVNVU#96870150 B&R Industrial Automation GmbH. が提供する Automation Studio 製品に複数の脆弱性
https://jvn.jp/vu/JVNVU96870150/

JVNVU#93266623 トレンドマイクロ製パスワードマネージャーにおける DLL 読み込みに関する脆弱性
https://jvn.jp/vu/JVNVU93266623/

JVNVU#99911229 トレンドマイクロ株式会社製の複数製品のインストーラにおける DLL 読み込みに関する脆弱性
https://jvn.jp/vu/JVNVU99911229/

JVNVU#94751438 HMS Networks 製 eWON Flexy および eWON Cosy におけるクロスサイトスクリプティングの脆弱性
https://jvn.jp/vu/JVNVU94751438/

Google 修復 Chrome 多個嚴重資安漏洞
https://www.twcert.org.tw/tw/cp-104-3487-99440-1.html

2.銀行/金融/保險/證券/支付系統/ 新聞及資安
糗!安達保險賣資安險 卻反被駭客集團勒索
https://www.phew.tw/article/cont/phewpoint/current/topic/8903/202004078903

富邦金下令 連假去熱門景點者明起居家辦公
https://news.tvbs.com.tw/life/1304301

國泰金緊急清查 6日起1,200人居家辦公
https://ctee.com.tw/news/finance/247477.html

跟進富邦 中信金新光金緊急調查連假旅遊史
https://ctee.com.tw/news/finance/247401.html

因應信用卡詐欺,VISA 強推支付安全藍圖
https://koin.kcg.gov.tw/?p=4056

好爽!銀行局證實 這家銀行本周全員居家上班
https://www.chinatimes.com/realtimenews/20200407005127-260410

請於2020年4月14日前更新行動銀行版本,以獲得更優質服務
https://bit.ly/39Yzf7j

金融業居家辦公有資安漏洞?金管會:需錄影等替代措施
https://money.udn.com/money/story/5613/4479604

金融業「居家辦公」 立委要求金管會防範資安漏洞
https://ec.ltn.com.tw/article/breakingnews/3128754

金管會:證券期貨業啟動居家辦公須達4條件
https://money.udn.com/money/story/5613/4480524

金融業居家辦公 這2種人例外
https://www.chinatimes.com/realtimenews/20200409002239-260410?chdtv

華為推出的 HUAWEI Card 實體信用卡,功能跟外型都和 Apple Card 激似
https://buzzorange.com/techorange/2020/04/10/huawei-launch-credit-card/

Magecart Hackers Inject iFrame Skimmers in 19 Sites to Steal Payment Data
https://thehackernews.com/2020/04/magecart-digital-skimmer.html

MakeFrame: Magecart Group 7’s Latest Skimmer Has Claimed 19 Victim Sites
https://www.riskiq.com/blog/labs/magecart-makeframe/

Magecart Group Hits Small Businesses With Updated Skimmer
https://www.bankinfosecurity.com/magecart-group-hits-small-businesses-updated-skimmer-a-14055

Online Credit Card Skimmers Are Thriving During the Pandemic
https://www.wired.com/story/magecart-credit-card-skimmers-coronavirus-pandemic/

Criminals hack Tupperware website with credit card skimmer
https://blog.malwarebytes.com/hacking-2/2020/03/criminals-hack-tupperware-website-with-credit-card-skimmer/

Travelex Reportedly Paid $2.3M Ransom To Hackers
https://www.pymnts.com/news/security-and-risk/2020/travelex-reportedly-paid-ransom-to-hackers/

3.電子支付/電子票證/行動支付/ pay/新聞及資安
電子支付躲不過疫情 2月交易金額年減逾16%
https://www.cardu.com.tw/news/detail.php?40419

「鈔票銅板」恐成新冠病毒傳染源,行動支付成新寵!快來看哪個平台回饋最多
https://www.storm.mg/lifestyle/2498142

壯大行動支付 LINE Pay攜手一卡通拚內需
https://www.setn.com/News.aspx?NewsID=723323

4.虛擬貨幣/區塊鍊相關新聞及資安
區塊鏈你Try了沒? 開放、資安不必選邊站 區塊鏈打造顧客共享社群
https://times.hinet.net/magazine/cp105/22850999

去中心化交易所 Bisq 爆發駭客攻擊!25 萬美元加密貨幣遭竊
https://blockcast.it/2020/04/09/hacker-exploited-software-flaw-and-stole-more-than-250k-worth-of-cryptocurrency-from-dex-bisq-users/

天王劉德華否認教人投資比特幣!過去還曾有過這3起假借名人名義的加密貨幣騙局
https://bit.ly/2UU9D6X

Bitcoin thieves use malicious QR code readers to steal $45,000 this month
https://hotforsecurity.bitdefender.com/blog/bitcoin-thieves-use-malicious-qr-code-readers-to-steal-45000-this-month-22778.html

Bisq Bitcoin exchange slams on the brakes after exploit of critical security flaw, crypto theft
https://www.zdnet.com/article/bisq-bitcoin-exchange-slams-on-the-breaks-following-exploit-of-critical-security-flaw/#ftag=RSSbaffb68

5.資安事件新聞

A.病毒木馬 / 殭屍網路 / 勒索軟體 / Adware /APT /後門程式
群創傳遭勒索病毒攻擊 生產未受影響
https://money.udn.com/money/story/5612/4478836

傳群創遭病毒勒索,稱不會影響生產
https://technews.tw/2020/04/09/it-is-said-that-innolux-was-blackmailed-by-the-virus-saying-it-will-not-affect-production/

他來了!WannaRen勒索病毒作者主動提供解密密鑰
https://www.huorong.cn/info/1586414080453.html?bsh_bid=5499278856&from=timeline

卡巴斯基:無法清除的xhelper 木馬
https://securelist.com/unkillable-xhelper-and-a-trojan-matryoshka/96487/

APT 攻擊者濫用微軟crypto api 釋放後門程序
https://gbhackers.com/apt-hackers-abusing-microsoft-crypto-api/

Clicker木馬新家族:Haken木馬
https://www.freebuf.com/articles/terminal/230524.html

SideWinder APT 組織4月活動情報
https://twitter.com/timele9527/status/1247325070520750080

Hoaxcalls DDoS 殭屍網絡利用Grandstream 和DrayTek 設備漏洞
https://unit42.paloaltonetworks.com/new-hoaxcalls-ddos-botnet/

Hoaxcalls 僵屍網絡:利用 CVE-2020-8515/5722 漏洞
https://www.chainnews.com/zh-hant/articles/194643303233.htm

難移除的 Android 惡意軟體,透過非官方 App Store 大量擴散
https://www.twcert.org.tw/tw/cp-104-3521-4178a-1.html

APTs and COVID-19: How advanced persistent threats use the coronavirus as a lure
https://blog.malwarebytes.com/threat-analysis/2020/04/apts-and-covid-19-how-advanced-persistent-threats-use-the-coronavirus-as-a-lure/

Ransomware in the Health Sector 2020 – A Perfect Storm of New Targets and Methods
https://www.riskiq.com/blog/external-threat-management/ransomware-in-health-sector-2020/

Breaking the Ice: A Deep Dive Into the IcedID Banking Trojan’s New Major Version Release
https://securityintelligence.com/posts/breaking-the-ice-a-deep-dive-into-the-icedid-banking-trojans-new-major-version-release/

Trickbot: A primer
https://blog.talosintelligence.com/2020/03/trickbot-primer.html

AZORult brings friends to the party
https://blog.talosintelligence.com/2020/04/azorult-brings-friends-to-party.html

CORONAVIRUS AS A DOUBLE-EDGED SWORD FOR CYBERCRIMINALS: DESPERATION OR OPPORTUNITY
https://www.digitalshadows.com/blog-and-research/coronavirus-as-a-double-edged-sword-for-cybercriminals/

CORONAVIRUS TROJAN OVERWRITING THE MBR
https://securitynews.sonicwall.com/xmlpost/coronavirus-trojan-overwriting-the-mbr/

GULOADER: THE RAT DOWNLOADER
https://blog.morphisec.com/guloader-the-rat-downloader

Zoomed In: A Look into a Coinminer Bundled with Zoom Installer
https://blog.trendmicro.com/trendlabs-security-intelligence/zoomed-in-a-look-into-a-coinminer-bundled-with-zoom-installer/

Obfuscated with a Simple 0x0A
https://isc.sans.edu/forums/diary/Obfuscated+with+a+Simple+0x0A/25982/

TPOT's Cowrie to ISC Logs
https://isc.sans.edu/diary/rss/25976

‘Zombie’ Windows win32k bug reanimated by researcher
https://nakedsecurity.sophos.com/2020/04/03/zombie-windows-win32k-bug-reanimated-by-researcher/

2020-04-02 - VBS-BASED MALWARE INFECTION
https://www.malware-traffic-analysis.net/2020/04/02/index.html

2020-03-31 - MATERIAL FOR AN ISC DIARY (QAKBOT MALSPAM)
https://www.malware-traffic-analysis.net/2020/03/31/index2.html

2020-03-31 - URSNIF (GOZI/IFSB) INFECTION
https://www.malware-traffic-analysis.net/2020/03/31/index.html

Pekraut - German RAT starts gnawing
https://www.gdatasoftware.com/blog/2020/04/35849-pekraut-german-rat-starts-gnawing

A New Look at Old Dragonfly Malware (Goodor)
https://norfolkinfosec.com/a-new-look-at-old-dragonfly-malware-goodor/

An old enemy – Diving into QBot part 1
https://malwareandstuff.com/an-old-enemy-diving-into-qbot-part-1/

PASSWORD STEALER TROJAN – MALWARE ANALYSIS
https://malwr-analysis.com/2020/03/28/password-stealer-trojan-malware-analysis/

Docker servers targeted by new Kinsing malware campaign
https://www.zdnet.com/article/docker-servers-targeted-by-new-kinsing-malware-campaign/

COVID-19 Outbreak Prompts Opportunistic Wave of Malicious Email Campaigns
https://symantec-blogs.broadcom.com/blogs/threat-intelligence/covid-19-outbreak-prompts-opportunistic-wave-malicious-email-campaigns

Malicious Android Apps Exploit Coronavirus Panic
https://symantec-blogs.broadcom.com/blogs/threat-intelligence/android-apps-coronavirus-covid19-malicious

Possible link between Magecart group & Cerberus Banking Trojan C2
https://medium.com/@Bank_Security/possible-link-between-magecart-group-cerberus-banking-trojan-c2-3d41ea8749ee

Loncom packer: from backdoors to Cobalt Strike
https://securelist.com/loncom-packer-from-backdoors-to-cobalt-strike/96465/

Latest Global COVID-19/Coronavirus Spearphishing Campaign Drops Infostealer
https://www.fortinet.com/blog/threat-research/latest-global-covid-19-coronavirus-spearphishing-campaign-drops-infostealer.html

New Agent Tesla Variant Spreading by Phishing
https://www.fortinet.com/blog/threat-research/new-agent-tesla-variant-spreading-by-phishing.html

DoppelPaymer Ransomware Operators Breached Commercial Development, Inc.
https://medium.com/@cyble/doppelpaymer-ransomware-operators-breached-commercial-development-inc-a43a6840a0e3

2020-04-02 - VBS-BASED MALWARE INFECTION
https://www.malware-traffic-analysis.net/2020/04/02/index.html

Unveiled: How xHelper Android Malware Re-Installs Even After Factory Reset
https://thehackernews.com/2020/04/how-to-remove-xhelper-malware.html

2020-04-07 - PCAP AND MALWARE FOR AN ISC DIARY (ZLOADER)
https://www.malware-traffic-analysis.net/2020/04/07/index.html

Trickbot, Emotet Malware Use Coronavirus News to Evade Detection
https://www.bleepingcomputer.com/news/security/trickbot-emotet-malware-use-coronavirus-news-to-evade-detection/

Phishing and Malware Attacks Against NASA Employees Have Doubled
https://hotforsecurity.bitdefender.com/blog/phishing-and-malware-attacks-against-nasa-employees-have-doubled-22891.html

B.行動安全 / iPhone / Android /穿戴裝置 /App
視訊聊天軟體Houseparty驚傳用戶個資遭駭,但官方表示是同行惡性競爭所致
https://www.ithome.com.tw/news/136763

視訊軟體 Zoom 爆紅!卻狂傳資安漏洞、電腦密碼也有遭竊風險
https://3c.ltn.com.tw/news/39998

【恐怖Zoom】地理課遭駭 39女學生被迫色情視訊
https://tw.appledaily.com/international/20200410/CQPP63OBU35KOLR4X7T7ISMT6E/

會議軟體Zoom涉隱私憂患 首席執行官承諾修補漏洞
https://newtalk.tw/news/view/2020-04-04/386056

爆紅視訊軟體Zoom連傳安全漏洞 創辦人致歉
https://www.rti.org.tw/news/view/id/2058252

Zoom中國研發引憂慮 NASA和SpaceX禁用
https://www.ntdtv.com/b5/2020/04/03/a102815094.html

Zoom一夕爆紅 客服招架不住
https://www.chinatimes.com/realtimenews/20200404002823-260410?ctrack=mo_main_rtime_p02&chdtv

視頻會議軟體Zoom引發安全憂慮 或向中共傳輸信息
https://www.secretchina.com/news/b5/2020/04/04/928592.html

Zoom 送中?非標準加密,可向中國傳送加密訊息、密鑰
https://www.inside.com.tw/article/19409-zoom-calls-routed-china

你的資料恐被「送中」..英國國防部、SpaceX、NASA都下令禁用Zoom
https://www.cmmedia.com.tw/home/articles/20689

Zoom又被抓包?宣稱用256位元的AES加密金鑰,但其實只有128位元
https://www.ithome.com.tw/news/136762

Zoom中國服務器發密鑰 釀安全風險
https://www.ntdtv.com/b5/2020/04/07/a102818078.html

Zoom 資安疑慮外,又被證實連線資料可能被送往中國
http://technews.tw/2020/04/05/zoom-it-is-confirmed-that-the-connection-information-may-be-sent-to-china/

Zoom官方證實將資料「誤傳」給中國!多國政府單位、知名企業都宣布禁用
https://www.storm.mg/lifestyle/2489547

視訊軟體Zoom承認傳輸數據到中國 每天2億場遠距會議爆資安漏洞 
https://bit.ly/2Vc64rK

Zoom 資安問題再起!會議安全嗎?會不會被竊聽?發言人回應
https://www.managertoday.com.tw/articles/view/59528

Zoom被爆疑向北京傳輸加密訊​息 中國創辦人道歉稱將改進
https://m.ltn.com.tw/news/world/breakingnews/3123301

認將用戶數據傳中國 Zoom稱失誤
https://bit.ly/3bY2Fnr

Zoom資安疑慮 爆加密訊​息傳輸中國
https://gnews.org/zh-hant/163656/

Zoom資安再出包?資料「誤傳」往中國伺服器袁征這樣回 學者提醒:要小心
https://cnews.com.tw/137200406a02/

以為刪掉Zoom就沒事?PTT創世神開示:連密碼都改才安全
https://newtalk.tw/news/view/2020-04-09/388713

【武漢肺炎】Zoom涉保安漏洞及數據傳向中國 華裔創辦人:再有差池將完蛋
https://hk.appledaily.com/finance/20200405/MRVNWZPK6Y6MQHELGXDXDJSYFI/

部分數據「送中」被抓包 Zoom執行長:我搞砸了
https://tw.appledaily.com/headline/20200406/3ZRBQ2KZX4QAQUE27FGMVQOZ4I/

Zoom 認部分客戶數據曾分流中國處理 加拿大研究質疑 「擁有中國心的美國公司」
https://bit.ly/3aKV1MS

Zoom被爆加密訊​息傳北京 林俊憲:對中國圍堵並非沒道理
https://news.ltn.com.tw/news/politics/breakingnews/3124875

Zoom 資安疑慮外,又被證實連線資料可能
https://www.ptt.cc/bbs/Stock/M.1586134477.A.9B4.html

Zoom漏洞不斷擴大 LinkedIn用戶慘受牽連
https://bit.ly/3aLu9w3

ZOOM掀波瀾 視訊軟體資安漏洞靠自己堵
https://www.chinatimes.com/realtimenews/20200405003038-260410?chdtv

存在資安隱憂 Zoom股東控告公司詐欺
https://news.cnyes.com/news/id/4461559

資安存在隱憂 Zoom遭股東控告證券詐欺
https://tw.appledaily.com/property/20200408/AYCL7FUMPAUGRXG2SGM27K36FA/

Zoom 保安漏洞被集體訴訟   疑誤導投資者違反美證券法
https://unwire.hk/2020/04/09/zoom-investors/tech-secure/

Zoom Was Mining Data and Matching Users with LinkedIn Info
https://hotforsecurity.bitdefender.com/blog/zoom-was-mining-data-and-matching-users-with-linkedin-info-22829.html

Zoom為安全漏洞道歉,承諾即刻凍結新功能的開發,專注安全及隱私的改善
https://ithome.com.tw/news/136742

曝出漏洞、企業禁用、緊急聲明:Zoom一周裡經歷了什麼
https://36kr.com/p/5308771

Zoom爆資安疑慮好可怕?台大電機系教授葉丙成揭真相
https://www.setn.com/News.aspx?NewsID=721197

會議視訊軟體Zoom遭爆資安疑慮 專家建議這樣做
https://bit.ly/34fEDSe

新的網路陰暗角落:認識因疫情興起的視訊攻擊手法,Zoombombing
https://www.inside.com.tw/article/19426-Zoombombing

Zoom為安全漏洞道歉發布“漏洞賞金”計劃
https://www.chinaz.com/2020/0403/1123139.shtml

ZOOM超夯遭爆開後門 科技界、學校掀退用潮
https://www.chinatimes.com/realtimenews/20200403001894-260412?chdtv

Zoom安全漏洞未除 美多間學校機構停用
https://bit.ly/2V6tDSW

課堂屢遭黑客「轟炸」 保安私隱成疑 紐約市教育局籲停用Zoom
https://bit.ly/3dYlngl

別再惡作劇了!密西根州警告:亂入Zoom會議將會被判刑
https://www.ithome.com.tw/news/136764

Zoom遠距會議軟體受惠疫情竄紅 資安專家:小心被監看
https://tw.appledaily.com/property/20200405/FJD6EFBJQTKQFAWYM52ZLU4R4Y/

Zoom爆重大安全漏洞:數万視頻被公開圍觀CEO考慮開源
http://tech.sina.com.cn/csj/2020-04-05/doc-iimxxsth3729974.shtml

曝出漏洞、企業禁用、緊急聲明:因疫情爆紅的Zoom,一週之內如何跌下神壇
https://bit.ly/39PLbYY

Zoom爆資安漏洞疑慮 中華電宣布立即停售
https://tw.appledaily.com/property/20200406/TI5DOVWCCH6T6XCSJMHVYWEE4E/

基於安全考量 紐約學校將停用視訊軟體Zoom
https://money.udn.com/money/story/5599/4469852

Zoom資安問題多,中華電信要求代理商解釋並宣布即日起停售
https://bit.ly/3bXxYhW

遠端會議不是直播 會計師:使用ZOOM要提高警覺
https://udn.com/news/story/7240/4470615

Zoom被指有保安漏洞可追蹤你的行蹤?教你3招避免資料被偷
https://www.18hall.com/zoom-cybersecurity/

Zoom 等著名視訊會議軟體成為眾多駭侵者假冒對象
https://www.twcert.org.tw/tw/cp-104-3486-60968-1.html

小心監看! Check Point 提供 Zoom 安全使用四大招
https://www.netadmin.com.tw/netadmin/zh-tw/snapshot/E6426ACB0E9A45DEB701A68BD0A4F245

全球最大雲端會議軟體服務Zoom,被爆出嚴重隱私漏洞
https://news.knowing.asia/news/efb28f64-eba0-4399-9eae-87540db10273

因屢爆資安疑慮,美國紐約下令各學校全面禁用 Zoom 改投 Teams
https://www.inside.com.tw/article/19414-New-York-City-bans-Zoom-in-schools-citing-security-concerns

ZOOM爆資安疑雲股價挫 布局資安ETF防漏洞
https://udn.com/news/story/7239/4474185

New Zoom Hack Lets Hackers Compromise Windows and Its Login Password
https://thehackernews.com/2020/04/zoom-windows-password.html

Zoom’s privacy and security woes in the spotlight
https://www.welivesecurity.com/2020/04/03/zoom-privacy-security-spotlight/

Zoom for macOS Has a Couple of Dangerous Zero-Day Vulnerabilities
https://hotforsecurity.bitdefender.com/blog/zoom-for-macos-has-a-couple-of-dangerous-zero-day-vulnerabilities-22816.html

Prosecutors: 'Zoom-Bombing' Could Lead to Charges
https://www.bankinfosecurity.com/prosecutors-zoom-bombing-could-lead-to-charges-a-14062

Zoom-bombing: FBI warns of rise in teleconference hijacking amid stay-at-home order
https://hotforsecurity.bitdefender.com/blog/zoom-bombing-fbi-warns-of-rise-in-teleconference-hijacking-amid-stay-at-home-order-22803.html

Using Zoom? Here’s how to keep your business and employees safe
https://blog.trendmicro.com/using-zoom-heres-how-to-keep-your-business-and-employees-safe/

Zoom Caught in Cybersecurity Debate — Here's Everything You Need To Know
https://thehackernews.com/2020/04/zoom-cybersecurity-hacking.html

國際產經:Zoom創辦人稱資安漏洞導致特斯拉停用,計劃引入點對點加密技術
https://bit.ly/3e01cia

FBI警告:遠距工作或教學工具可能成為駭客攻擊的新目標
https://www.ithome.com.tw/news/136752

美國各級學校禁用 ZOOM !FBI警告:視訊會議恐遭駭客入侵
https://3c.ltn.com.tw/news/40017

Zoom資安漏洞超大?內行人揭「恐怖真相」:只刪除還不夠
https://bit.ly/2XqGu5j

Zoom宣布90天資安強化計畫,聘請臉書前安全長擔任外部顧問
https://www.ithome.com.tw/news/136860

安全標準不合格!Google 全面禁止員工使用 Zoom
https://3c.ltn.com.tw/news/40051

Zoom爆資安疑慮! 王定宇「3點警告」:調查間諜行為
https://www.setn.com/news.aspx?NewsID=721133

部分被盜取的 Zoom 用戶密碼與 ID 已經在暗網出售
https://technews.tw/2020/04/08/stolen-zoom-id-sale-on-darkweb/

報導:駭客在暗網中公布352個Zoom帳號
https://www.ithome.com.tw/news/136852

Zoom再爆資安疑慮!352 個帳戶遭外洩 個資在暗網「共享」
https://udn.com/news/story/11017/4477119

教育部禁用Zoom 宅神酸:學校教學是有什麼機密
https://bit.ly/3aYTvXq

學校禁用ZOOM惹議 教長:行政院已審慎評估
https://www.cna.com.tw/news/ahel/202004080258.aspx

教部禁用Zoom 高中老師激憤:教學哪來資安問題
https://udn.com/news/story/120960/4474620?from=udn-catebreaknews_ch2

修電腦才有艷門照?杜奕瑾驚曝漏洞:現在裝Zoom就夠了
https://www.setn.com/news.aspx?NewsID=721729

ZOOM爆資案漏洞 國泰投信:拚防疫也要注意防駭
https://www.chinatimes.com/realtimenews/20200407003492-260410?ctrack=mo_main_rtime_p12&chdtv

How i hacked worldwide ZOOM users
https://medium.com/@s3c/how-i-hacked-worldwide-zoom-users-eafdff94077d

使用 Zoom 開視訊會議前,必須確認的資安基本要點
https://blog.trendmicro.com.tw/?p=63877

Zoom備受質疑 在家工作如何顧資安?台積電有祕技
https://bit.ly/2y4yJad

Zoom袁征:強化資安保護 相信台灣會解除禁用令
https://money.udn.com/money/story/5599/4481399

HKCERT 建議10招保障 Zoom 網上會議安全
https://www.hkcert.org/my_url/zh/blog/20040201

第三方收集資訊不再容易!臉書將推新工具讓用戶擴大權限盼減少資安問題
https://bit.ly/39PyiOA

【當我們硬塞在家】還在用 LINE?遠端工作企業通訊軟體挑選指南
https://www.inside.com.tw/article/19384-company-saas-for-wfh

串接資料與手機訊號 跨部門追蹤居家檢疫者足跡
https://money.udn.com/money/story/5613/4468913

Teams誤傳資安漏洞 台灣微軟:已修補完成
https://money.udn.com/money/story/5612/4472228

遠距軟體雙面刃 「4要3不」防資安裸奔
https://udn.com/news/story/120960/4475485

【重磅快評】突然封殺Zoom 試問林全揪科群組還在否
https://udn.com/news/story/11091/4475925

網友求救研發「安全視訊APP」 唐鳳不藏私推薦「這三款」視訊系統
https://www.ettoday.net/news/20200407/1686085.htm

How Just Visiting A Site Could Have Hacked Your iPhone or MacBook Camera
https://thehackernews.com/2020/04/hacking-iphone-macbook-camera.html

>4,000 Android apps silently access your installed software
https://arstechnica.com/information-technology/2020/03/4000-android-apps-silently-access-your-installed-software/

What to do you if your phone is lost or stolen
https://www.welivesecurity.com/2020/04/06/what-to-do-phone-lost-stolen/

Australian Kids' Smartwatch Maker Hit By Same Bug Again
https://www.bankinfosecurity.com/australian-kids-smartwatch-maker-hit-by-same-bug-again-a-14046

C.事件 / 駭客 / DDOS / APT / 雲端/ 暗網/ 徵才 / 國際資安事件
應對網路入侵  災難復原分秒必爭
https://unwire.pro/2020/04/04/ibm-dr/columnist/

網友哀嚎!台最大追劇「楓林網」遭查封 老闆是2台大碩士
https://www.setn.com/News.aspx?NewsID=721793

COVID-19 (新型冠狀病毒) 帶來那些新的網路威脅
https://www.computerdiy.com.tw/20200407_covid-19_threaten/

防疫遠距辦公 KPMG示警:當心企業機密網路裸奔
https://money.udn.com/money/story/5612/4470828

全球200大CDN發生BGP劫持,Google、Cloudflare、Line皆被導向俄羅斯
https://www.ithome.com.tw/news/136758

趨勢科技:組態設定錯誤 是雲端環境頭號風險
https://udn.com/news/story/7240/4479385

資安控管應先於遠距辦公
https://talk.ltn.com.tw/article/paper/1364168

曾阻止惡意軟體被稱英雄!網路安全專家自寫程式遭起訴 最終法官這樣判
https://news.sina.com.tw/article/20200403/34749846.html

疑遭駭客連續16小時攻擊?wecare高雄官網暫時閉站
https://6do.news/article/2467442-01

罷韓粉專被駭 Wecare籲勿以身試法
http://www.nexttv.com.tw/NextTV/News/Home/Politics/2020-04-04/148983.html

駭客連攻官網16小時 Wecare高雄急關站保資安
https://newtalk.tw/news/view/2020-04-04/386134

疑遭駭客連續16小時攻擊?wecare高雄官網
https://www.ptt.cc/bbs/Gossiping/M.1585963095.A.B67.html

Evernote及其他共享平台遭網路釣客盯上
https://blog.trendmicro.com.tw/?p=63869

網路罪犯以新冠病毒為主題,對企業發動社交工程攻擊
https://times.hinet.net/news/22853669

疫情期間 網路犯罪成長5倍 攻擊醫院
https://www.ntdtv.com/b5/2020/04/08/a102818951.html

霸氣!玩家喊武漢肺炎遭封10年 台廠捍衛自由與中國恩斷義絕
https://3c.ltn.com.tw/news/40013

趨勢科技發布全球假冒新冠肺炎疫情之網路威脅情勢
https://news.sina.com.tw/article/20200405/34760378.html

美英網安機關警告 政治背景駭客利用疫情滲透網路
https://taronews.tw/2020/04/09/652784/

WhatsApp控以色列駭客集團助20國政府入侵手機 沒想到遭反駁說臉書原本也想買
https://cnews.com.tw/134200407a03/

深信服VPN設備被曝成境外駭客突破口 回應稱極少數用戶受影響
http://big5.china.com.cn/gate/big5/tech.china.com.cn/internet/20200407/364891.shtml

利用內核漏洞 中國默默駭全球linux近十年
https://www.ptt.cc/bbs/Gossiping/M.1586317309.A.9A5.html

中國駭客攻擊 Linux 伺服器,竊取知識產權長達 10 年沒被發現
https://buzzorange.com/techorange/2020/04/09/chinese-hack-linux/

中國駭客駭過臺灣什麼情報
https://www.pttweb.cc/bbs/Gossiping/M.1586062387.A.0D8

神秘APT組織利用IE和Firefox漏洞攻擊中國和日本
https://www.4hou.com/posts/Zm5J

美國2020~2022年反情報戰略
https://www.freebuf.com/articles/network/230126.html

美陸戰隊網路防禦小組 首納編MEU部署巡弋
https://www.ydn.com.tw/News/379195

因應疫情流量暴增需求,美國政府同意Google啟用連結加州與臺灣的海底電纜為期6個月
https://www.ithome.com.tw/news/136856

Hackers exploited IE and Firefox flaws in attacks on entities in China, Japan
https://securityaffairs.co/wordpress/100960/hacking/ie-firefox-flaws.html

IEの脆弱性 (CVE-2020-0674) とFirefoxの脆弱性 (CVE-2019-17026) を悪用する攻撃
https://blogs.jpcert.or.jp/ja/2020/04/ie_firefox_0day.html

Cyber News Rundown: Zoom Targeted by Hackers
https://www.webroot.com/blog/2020/04/06/cyber-news-rundown-zoom-targeted-by-hackers/

Coronavirus-related cyberattacks surge in Brazil
https://www.zdnet.com/article/coronavirus-related-cyberattacks-surge-in-brazil/#ftag=RSSbaffb68

Italian Social Security Website Disrupted
https://www.bankinfosecurity.com/italian-social-security-website-disrupted-a-14054

Italy's social security website hit by hacker attack
https://www.reuters.com/article/us-health-coronavirus-italy-cybercrime/italys-social-security-website-hit-by-hacker-attack-idUSKBN21J5U1

FBI Alleges Russian Man Laundered Cybercriminals' Money
https://www.bankinfosecurity.com/fbi-alleges-russian-man-laundered-cybercriminals-money-a-14041

Top spies are enlisted to 'attack and destroy' foreign cyber criminals preying on vulnerable Australians during the coronavirus pandemic
https://www.dailymail.co.uk/news/article-8194863/Australian-government-enlists-spies-attack-foreign-cyber-criminals-preying-vulnerable-people.html

DOJ urges FCC to revoke China Telecom's license
https://www.zdnet.com/article/doj-urges-fcc-to-revoke-china-telecoms-license/#ftag=RSSbaffb68

March 2020 Cyber Attacks Statistics
https://www.hackmageddon.com/2020/04/08/march-2020-cyber-attacks-statistics/

16-31 March 2020 Cyber Attacks Timeline
https://www.hackmageddon.com/2020/04/07/16-31-march-2020-cyber-attacks-timeline/

資安防護管理人員(網路安全)
https://www.104.com.tw/job/6wvip

不畏疫情 合庫徵才360人
https://ec.ltn.com.tw/article/breakingnews/3124469

合庫招募360人 配合推出徵才短片
https://money.udn.com/money/story/5636/4472281

財團法人大學入學考試中心 求才啟事
https://bit.ly/2xZi2x1

大規模在家工作牽動職場三大改變 資安工程師需求逆勢增
https://news.cnyes.com/news/id/4462005

系統資安工程師
https://job.taiwanjobs.gov.tw/Internet/jobwanted/JobDetail.aspx?EMPLOYER_ID=356366&HIRE_ID=9636991

D.資料外洩/個資法/GDPR/網路詐騙/網路釣魚/盜刷/假新聞
防疫宅在家 詐騙變多了性交易少了
https://udn.com/news/story/7315/4465529?from=udn-catelistnews_ch2

艦船開假訊號偽冒遼寧艦 國防部快速打擊:「假訊息」
https://udn.com/news/story/10930/4480616

網路出現「165在線反詐騙聯盟」 警方:新騙術
https://www.kmdn.gov.tw/1117/1271/1272/317503/

359件假訊息案7成來自中國 調查局揭攻擊模式
https://bit.ly/2y0knbd

Cisco WebEx 視訊會議用戶,近來遭到詐騙更新訊息攻擊
https://www.twcert.org.tw/tw/cp-104-3526-63a65-1.html

不肖人士利用疫情資訊釣魚 趨勢科技:垃圾郵件佔資安威脅逾6成
https://tw.appledaily.com/property/20200404/FD2JVLIIBL5OM5MVCK3O2IJFWI/

在家工作的惡夢!個資遭辦公軟體分享還被老闆監控
https://newtalk.tw/news/view/2020-04-04/386078

電子追蹤系統資訊全都露 防疫與隱私權的兩難
https://money.udn.com/money/story/5613/4468966

美國參議員對蘋果COVID-19應用的隱私問題提出質疑
https://news.sina.com.tw/article/20200404/34753126.html

防疫串聯個資 法界促訂退場條例
https://www.merit-times.com.tw/NewsPage.aspx?unid=581028

誤信5G傳播病毒謠言 英國基地台被燒毀
https://udn.com/news/story/6809/4468741

開箱灑10萬!小玉買「駭客技術」慘被騙 網傻眼:果然有錢就是任性
https://zodiac.tw/200403

冠狀病毒》疫發不可收拾的網路謠言,如何教孩子分辨
https://blog.trendmicro.com.tw/?p=63775

調查局再查5案假訊息 男竟指「澎湖已淪陷」
https://tw.appledaily.com/local/20200408/K7EL4MXOMQGLDYQ7VHWTPQLIOQ/

義大利電子郵件服務email.it遭駭,60萬用戶資料流落黑市
https://ithome.com.tw/news/136843

小心相關網站釣魚郵件 美英警告有駭客利用疫情滲透網路
https://www.cna.com.tw/news/aopl/202004090045.aspx

數位錢包 App Key Ring 雲端設定錯誤,導致四千四百萬筆用戶個資外洩
https://www.twcert.org.tw/tw/cp-104-3504-f2b14-1.html

Data Breach: A summary of healthcare security incidents in March 2020. Are you a victim of Medical Identity Theft
https://bit.ly/39Q6Q3e

THREAT ACTORS RECYCLING PHISHING KITS IN NEW CORONAVIRUS (COVID-19) CAMPAIGNS
https://blogs.akamai.com/sitr/2020/04/threat-actors-recycling-phishing-kits-in-new-coronavirus-covid-19-campaigns.html

“Instant bank fraud” warning spread on WhatsApp is a hoax
https://nakedsecurity.sophos.com/2020/03/31/instant-bank-fraud-warning-spread-on-whatsapp-is-a-hoax/

Email provider got hacked, data of 600,000 users now sold on the dark web
https://www.zdnet.com/article/email-provider-got-hacked-data-of-600000-users-now-sold-on-the-dark-web/#ftag=RSSbaffb68

Nigerian BEC Scammers Increase Proficiency: Report
https://www.bankinfosecurity.com/nigerian-bec-scammers-increase-proficiency-report-a-14040

Spam and phishing in 2019
https://securelist.com/spam-report-2019/96527/

Scam alert: UK citizens receive fake text messages amid lockdown. If you plan to leave the house, you better pay up
https://hotforsecurity.bitdefender.com/blog/scam-alert-uk-citizens-receive-fake-text-messages-amid-lockdown-if-you-plan-to-leave-the-house-you-better-pay-up-22882.html

Elasticsearch Database with 42 Million Records of Iranian Citizen Found Exposed Online
https://hotforsecurity.bitdefender.com/blog/elasticsearch-database-with-42-million-records-of-iranian-citizen-found-exposed-online-22852.html

Data Leak: Private information of 14 million Key Ring users exposed
https://hotforsecurity.bitdefender.com/blog/data-leak-private-information-of-14-million-key-ring-users-exposed-22842.html

E.研究報告
已知現存中文 BBS 站台
https://hackmd.io/C8BLsIHbTUiVgdPHvmlZ_A

線上程式開發平台的資安風險
https://blog.trendmicro.com.tw/?p=63661

Donot team 組織(APT-C-35)移動端攻擊活動分析
https://s.tencent.com/research/report/951.html

高清還原進攻分析-被微軟發布又秒刪的遠程預執行代碼漏洞CVE-2020-0796
https://www.aqniu.com/vendor/66443.html

漏洞掃描工具-- Skipfish
https://zhuanlan.zhihu.com/p/123363993

Fuzzowski:一款功能強大的網絡協議模糊測試工具
https://www.freebuf.com/sectool/227869.html

PrivescCheck:一款針對Windows系統的提權枚舉腳本
https://www.freebuf.com/articles/system/229405.html

利用COVID-19發起的網絡攻擊分析
https://www.freebuf.com/articles/network/230475.html

網路犯罪天堂Deer.io之死
https://www.freebuf.com/news/232163.html

Wazuh:如何對離散數據進行關聯重組
https://www.freebuf.com/sectool/230505.html

挖洞經驗分享:關於IDOR的幾個奇怪案例分析
https://www.freebuf.com/vuls/228918.html

Android Cerberus惡意樣本分析
https://www.freebuf.com/articles/terminal/230628.html

JMX遠程代碼漏洞研究
https://www.freebuf.com/vuls/231132.html

Syborg:一款帶有斷路躲避系統的DNS子域名遞歸枚舉工具
https://www.freebuf.com/sectool/227851.html

CVE-2020-8794:OpenSMTPD默認安裝中的LPE和RCE漏洞分析
https://www.freebuf.com/vuls/228704.html

技術討論| 如何編寫一段內存蠕蟲
https://www.freebuf.com/articles/web/229597.html

Web安全漏洞系列:XSS(跨站腳本攻擊)
https://www.freebuf.com/video/232923.html

WAF機制及繞過方法總結:注入篇
https://www.freebuf.com/articles/web/229982.html

一種工控蜜罐識別與反識別技術研究與應用實踐
https://www.freebuf.com/articles/ics-articles/230402.html

2019年網絡安全態勢報告
https://www.freebuf.com/articles/paper/232371.html

Zeek如何提供對加密通信的感知
https://www.freebuf.com/articles/network/229767.html

2020年Pwn2Own中VMware虛擬機逃逸最新UAF漏洞分析(CVE-2020-3947)
https://www.4hou.com/posts/6zkn

QQ二維碼登陸機制分析+雙重SSRF釣魚利用
https://www.freebuf.com/vuls/229694.html

2019 東京PWN2OWN TP-Link Archer A7 exp 開發詳解
https://www.thezdi.com/blog/2020/4/6/exploiting-the-tp-link-archer-c7-at-pwn2own-tokyo

GTFOBins:一個用來繞過本地安全限制的Unix 二進製程序列表
https://gtfobins.github.io/

使用Slack 的TURN 服務器來訪問內部服務(ssrf)
https://www.rtcsec.com/2020/04/01-slack-webrtc-turn-compromise/

漏洞管理面面觀
https://www.freebuf.com/vuls/232791.html

大型企業如何部署落地(雲)主機EDR+態勢感知平台
https://www.freebuf.com/articles/es/230196.html

繞過sysmon 和windows 事件日誌的通用手法
https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/

“震網”三代和二代漏洞技術分析報告
https://www.anquanke.com/post/id/202705

漏洞分析學習之cve-2010-2553
https://xz.aliyun.com/t/7520

Abnormal Attack Stories: Stimulus Payment Attack
https://abnormalsecurity.com/blog/abnormal-attack-stories-stimulus-payment-attack/

Preparing for the Surge in Attacks Targeting Remote Workers
https://www.fortinet.com/blog/threat-research/preparing-for-the-surge-in-attacks-targeting-remote-workers.html

BurpSuite basic use cases
https://www.peerlyst.com/posts/burpsuite-basic-use-cases-ben-johnson-cissp-gmob-gwapt

More Than 8,000 Unsecured Redis Instances Found in the Cloud
https://blog.trendmicro.com/trendlabs-security-intelligence/more-than-8000-unsecured-redis-instances-found-in-the-cloud/

How Relevance Scoring Can Make Your Threat Intelligence More Actionable
https://securityintelligence.com/posts/how-relevance-scoring-can-make-your-threat-intelligence-more-actionable/

automation-script
https://github.com/resotto/automation-script

How to Setup Wazuh Open Source SIEM Virtual Machine
https://thelinuxos.com/how-to-setup-wazuh-open-source-siem/

Python String Functions
https://thelinuxos.com/python-string-functions/

Cloud WAF Comparison Using Real-World Attacks
https://medium.com/fraktal/cloud-waf-comparison-using-real-world-attacks-acb21d37805e

Zero-Day Exploitation Increasingly Demonstrates Access to Money, Rather than Skill — Intelligence for Vulnerability Management, Part One
https://bit.ly/39Uu48o

Offense and Defense – A Tale of Two Sides: Bypass UAC
https://www.fortinet.com/blog/threat-research/offense-and-defense-a-tale-of-two-sides-bypass-uac.html

IEの脆弱性 (CVE-2020-0674) とFirefoxの脆弱性 (CVE-2019-17026) を悪用する攻撃
https://blogs.jpcert.or.jp/ja/2020/04/ie_firefox_0day.html

Thinking Outside the Bochs: Code Grafting to Unpack Malware in Emulation
https://www.fireeye.com/blog/threat-research/2020/04/code-grafting-to-unpack-malware-in-emulation.html

Fingerprint cloning: Myth or reality
https://blog.talosintelligence.com/2020/04/fingerprint-research.html

Introducing RedELK – Part 1: why we need it
https://outflank.nl/blog/2019/02/14/introducing-redelk-part-1-why-we-need-it/

RedELK Part 2 – getting you up and running
https://outflank.nl/blog/2020/02/28/redelk-part-2-getting-you-up-and-running/

RedELK Part 3 – Achieving operational oversight
https://outflank.nl/blog/2020/04/07/redelk-part-3-achieving-operational-oversight/

Hunting for evil: detect macros being executed
https://outflank.nl/blog/2018/01/16/hunting-for-evil-detect-macros-being-executed/

Mark-of-the-Web from a red team’s perspective
https://outflank.nl/blog/2020/03/30/mark-of-the-web-from-a-red-teams-perspective/

Red Team Tactics: Advanced process monitoring techniques in offensive operations
https://outflank.nl/blog/2020/03/11/red-team-tactics-advanced-process-monitoring-techniques-in-offensive-operations/

Red Team Tactics: Active Directory Recon using ADSI and Reflective DLLs
https://outflank.nl/blog/2019/10/20/red-team-tactics-active-directory-recon-using-adsi-and-reflective-dlls/

ARCHITECTING MOBILE BANKING APPS AGAINST ATTACKERS
https://bit.ly/3e4j37A

Securely donate CPU time with Windows Sandbox
https://techcommunity.microsoft.com/t5/windows-kernel-internals/securely-donate-cpu-time-with-windows-sandbox/ba-p/1285749#

Kerberos Tickets on Linux Red Teams
https://www.fireeye.com/blog/threat-research/2020/04/kerberos-tickets-on-linux-red-teams.html

F.商業
Cisco Webex 網上會議平台升級!免費版無時間限制、支援人數倍增
https://bit.ly/2wj0wn4

疫情帶動需求!思科視訊會議軟體Webex用戶創新高
https://bit.ly/2XbbeXP

年初揭 Zoom 保安風險  Check Point 籲企業採取零信任政策
https://unwire.pro/2020/04/04/check-point/security/

Zoom爆資安漏洞遭抵制 Skype強打免登入視訊功能
https://www.chinatimes.com/realtimenews/20200407001928-260412?chdtv

Zoom被揭存在大量保安漏洞!Skype推出全新會議功能搶客源
https://bit.ly/39NSeB9

避免數百萬企業遭駭客劫持的災難,微軟終於買下corp.com網域
https://www.ithome.com.tw/news/136832

資訊戰及網路威脅加劇 資安服務需求CAGR將達21%
https://bit.ly/2VhZQqv

2023年台灣資安服務市場年複合增長率 將達21%
https://money.udn.com/money/story/5607/4474385

勒索病毒攻擊增五倍!微軟戮力強化遠距工作與學習之資安防護網
https://news.sina.com.tw/article/20200409/34813122.html

具指紋和肛門辨識的智慧型馬桶!個人化健康監測不落空
https://bit.ly/34lv5oy

數聯資安推「3S資安訂閱服務」,讓資安輕鬆擁有
http://www.netadmin.com.tw/netadmin/zh-tw/snapshot/09BAC987E99B43EEB17672CA24F942A2

Microsoft announces IPE, a new code integrity feature for Linux
https://www.zdnet.com/article/microsoft-announces-ipe-a-new-code-integrity-feature-for-linux/#ftag=RSSbaffb68

Microsoft to add DANE and DNSSEC support to Exchange Online servers
https://www.zdnet.com/article/microsoft-to-add-dane-and-dnssec-support-to-exchange-online-servers/#ftag=RSSbaffb68

Linux Foundation backs security-oriented seL4 microkernel operating system
https://www.zdnet.com/article/linux-foundation-backs-security-oriented-sel4-microkernel-operating-system/#ftag=RSSbaffb68

支援NFC的Chrome 81來了
https://times.hinet.net/news/22854865

Chrome 81 released with initial support for the Web NFC standard
https://www.zdnet.com/article/chrome-81-released-with-initial-support-for-the-web-nfc-standard/#ftag=RSSbaffb68

Google backs Apple's SMS OTP standard proposal
https://www.zdnet.com/article/google-backs-apples-sms-otp-standard-proposal/#ftag=RSSbaffb68

G.政府
三軍地面部隊連長將人手一台平板 裡頭是什麼名堂
https://udn.com/news/story/10930/4468887

口罩實名制2.0推手 關貿公司12天完成國家級任務
https://udn.com/news/story/120974/4468950

肝12天做口罩實名制2.0 工程師:高壓也很高興
https://m.ltn.com.tw/news/politics/breakingnews/3123725

國軍網戰武器曝光 「弱點掃瞄軟體」主動掃瞄敵伺服器
https://udn.com/news/story/10930/4469093

口罩線上購買推手!eMask戰情室每日監控數量
https://news.tvbs.com.tw/life/1304803

金控防疫不同調 金管會:關注「金融服務不中斷」
https://ec.ltn.com.tw/article/breakingnews/3124850

電子圍籬兼顧監控與隱私 逾10國洽詢技術
https://www.cna.com.tw/news/firstnews/202004080142.aspx

【資安疑慮】國防部坦承曾用Zoom 未傳輸涉密資訊
https://tw.appledaily.com/politics/20200408/CJP7QBUMF3SIZ2BAYNJVES4NFM/

Zoom驚爆中國資安危機 司法院用了3年火速轉軌
https://news.ltn.com.tw/news/society/breakingnews/3128719

有資安疑慮 政院禁用ZOOM遠距視訊軟體
https://www.rti.org.tw/news/view/id/2058663

ZOOM禁用 花蓮教育處加緊教學新視訊軟體
https://udn.com/news/story/7328/4479638

特斯拉、美太空總署都禁用!司法院視訊竟用中資軟體「ZOOM」
https://bit.ly/3dYzm5O

Zoom有資安疑慮 外交部:未使用
https://money.udn.com/money/story/7307/4471887

zoom爆資安爭議 蘇揆:會有應對措施
https://bit.ly/2yAuinW

高市府市政會議 下周改視訊連線
https://udn.com/news/story/7327/4473396

Zoom爆資安疑慮! 中市府:跟進政院採CISCO
https://news.ltn.com.tw/news/politics/breakingnews/3128157

公務機關遠端視訊應優先使用國內產品及共同供應契約品項 避免資安疑慮
https://www.ey.gov.tw/Page/9277F759E41CCD91/9d2f8e8e-c8a6-4e1d-a9fe-68c3edb8ef72

Zoom爆資安疑慮! 陳其邁:公務機關視訊軟體應使用國產品
https://news.ltn.com.tw/news/politics/breakingnews/3125311

國防部曾將ZOOM用於救災
https://udn.com/news/story/10930/4476483?from=udn-catelistnews_ch2

Zoom 存嚴重安全漏洞 台灣國防部、國安局、行政院及教育部全面禁用
https://bit.ly/3c1qFpB

視訊軟體Zoom個資危機升溫 國防部緊急下令全面停用
https://bit.ly/2JOwZ7J

Zoom遭抵制!台、德政府下禁令 又被爆數百名用戶個資被放上暗網販賣
https://cnews.com.tw/137200409a04/

FBI曾示警「有資安疑慮」 教育部竟防疫停課期間推薦用中國視訊軟體Zoom
https://www.eatnews.net/article-2/20200405-1

視訊軟體遭爆資料傳中國 外交部:未使用ZOOM
https://times.hinet.net/news/22851600

Zoom爆資安疑慮 公務部門禁用
https://news.ltn.com.tw/news/politics/paper/1364183

立委點名教育部、司法院,籲公部門禁用 Zoom
https://www.inside.com.tw/article/19430-Judical-Yuan-use-security-concerns-zoom

關於Zoom風波 教育部長潘文忠 再度強調資安重要
https://news.sina.com.tw/article/20200408/34800904.html

ZOOM爆資安疑慮 網友求救唐鳳 竟真釣出本尊回應
https://news.ltn.com.tw/news/politics/breakingnews/3126202

國安等級!小英授權成立「資安站」 調查局第四軍成形
https://news.ltn.com.tw/news/politics/breakingnews/3127548

蔡清祥建議獲採納 調查局成立資安工作站
https://bit.ly/2Vf4zce

調局資安站:2月下旬迄今,陸網民已發動3波疫情假訊息攻擊
https://www.chinatimes.com/realtimenews/20200408005058-260402?chdtv

調查局成立資安工作站 偵辦假訊息、電腦犯罪案件
https://www.rti.org.tw/news/view/id/2058901

調查局成立資安工作站 偵辦假訊息、電腦犯罪案件
https://www.rti.org.tw/news/view/id/2058901

獨家直擊機密防疫系統 10國搶著學都想複製貼上
https://bit.ly/2Vaqb9Q

政院:視訊會議 不使用資安疑慮軟體
https://www.ydn.com.tw/News/379248

政院幕僚愛用Line 公務員以Juiker為主
https://udn.com/news/story/6656/4476132

教育部停用Zoom 學者:典型的資安管理作法
https://udn.com/news/story/6656/4476620

採Teams系統 教育部部務會報改視訊開會
https://m.ltn.com.tw/news/life/breakingnews/3127076

不忍了!江宜樺竟嗆禁用ZOOM「決策顛三倒四」
https://www.setn.com/News.aspx?NewsID=721970

內政部想啟動視訊會議〝但發現軟體都是ZOOM〞
https://udn.com/news/story/6656/4476482?from=udn-catelistnews_ch2

總統府:未採購Zoom等有資安疑慮產品
https://money.udn.com/money/story/7307/4474688

Taiwan instructs government agencies not to use Zoom
https://www.zdnet.com/article/taiwan-instructs-government-agencies-not-to-use-zoom/#ftag=RSSbaffb68

H.工控系統/SCADA/ICS
老舊作業系統為醫療IoT裝置帶來安全威脅
https://www.eettaiwan.com/20200407NT21-The-legacy-OS-brings-security-risk-to-connected-medical-devices/

Advantech WebAccess/NMS 路徑遍歷漏洞
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10631

JVNVU#93617857 KUKA 製 KUKA.Sim Pro における通信チャネルで送信中のメッセージの整合性への不適切な強制の脆弱性
https://jvn.jp/vu/JVNVU93617857/

JVNVU#98887141 富士電機製 V-Server Lite におけるバッファオーバーフローの脆弱性
https://jvn.jp/vu/JVNVU98887141/

JVNVU#99126710 Rockwell Automation 製 RSLinx Classic における重要なリソースに対する不適切なパーミッションの割り当ての脆弱性
https://jvn.jp/vu/JVNVU99126710/

JVNVU#95253418 GE Digital 製 CIMPLICITY における不適切な権限管理の脆弱性
https://jvn.jp/vu/JVNVU95253418/

JVNVU#98887141 富士電機製 V-Server Lite におけるバッファオーバーフローの脆弱性
https://jvn.jp/vu/JVNVU98887141/

I.教育訓練
How to become a cyber forensics expert
https://www.peerlyst.com/posts/how-to-become-a-cyber-forensics-expert-abhinav-singh

Binary Exploitation
https://guyinatuxedo.github.io/00-intro/index.html

J.物聯網/IOT/人工智慧/車聯網/光聯網/深度學習/機器學習/無人機/人臉辨識
智慧家電不安全?數位安全要注意 FBI警告:駭客攻擊早已發生
https://cnews.com.tw/137200403a02/

Cybersecurity labeling scheme introduced to help users choose safe IoT devices
https://blog.malwarebytes.com/iot/2020/04/cybersecurity-labeling-scheme-introduced-to-help-users-choose-safe-iot-devices/

6.近期資安活動及研討會
ISO/IEC 27001:2013 資訊安全稽核師(主導稽核員)訓練課程 4/11 ~ 4/26
https://www.accupass.com/event/2002140726181428485387

第二屆ICANN APAC-TWNIC Engagement Forum 與第34屆TWNIC IP政策資源管理會議 4/16
https://forum.twnic.tw/2020/registration.htm

資安產業標準輔導暨推廣說明會 4/16
https://www.accupass.com/event/2003310711227678203960

交通大學駭客書院 -入侵行為發覺與應變指南 4/18
https://hackercollege.nctu.edu.tw/?p=1144

2020全方位資訊安全人才培育計畫 4/21 ~ 6/16
http://service.tabf.org.tw/tw/user/409646/

網駭,鑑識工具操作與證據追蹤分析 4/17
https://bit.ly/2UVwP55

2020 Industrial Control Systems (ICS) Cyber Security Conference | Singapore  4/21 ~ 4/23
https://www.icscybersecurityconference.com/singapore/

Taipei 暗号通貨 (Cryptocurrency) Meetup 4/22
https://www.meetup.com/Taipei-%E6%9A%97%E5%8F%B7%E9%80%9A%E8%B2%A8-Cryptocurrency-Meetup/events/nrxgwqybcgbdc/

亞太資訊安全論壇暨展覽會 4/22
https://www.twcert.org.tw/tw/cp-105-3149-70ad7-1.html

交通大學駭客書院 - 基礎網頁安全與滲透測試 4/25
https://hackercollege.nctu.edu.tw/?p=1147

2020 LINE Taiwan Developers Recruitment Day  4/25
https://engineering.linecorp.com/zh-hant/blog/2020-line-taiwan-technical-recruitment-day/

金融數據應用 統計+視覺化 4/26
https://tw.pyladies.com/events/event.html?id=179

交通大學駭客書院 -     基礎網站安全建構實務 5/16
https://hackercollege.nctu.edu.tw/?p=1151

資安社 - Forensic(一) 5/20
https://nsysuisc.kktix.cc/events/2020forensic1

交通大學駭客書院 -     電子郵件之偽造攻擊與防護措施 5/23
https://hackercollege.nctu.edu.tw/?p=1156

Taipei 暗号通貨 (Cryptocurrency) Meetup 5/27
https://www.meetup.com/Taipei-%E6%9A%97%E5%8F%B7%E9%80%9A%E8%B2%A8-Cryptocurrency-Meetup/events/nrxgwqybchbkc/

交通大學駭客書院 -     進階網頁滲透測試 5/30
https://hackercollege.nctu.edu.tw/?p=1159

109年智能物聯網與資訊安全碩士學分班 5/30 ~ 8/8
https://www.accupass.com/event/2003160837472127685300

邊緣計算系統之大數據與深度學習應用 6/5
https://edu.nchc.org.tw/course/one_course_introduction.asp?lms_auto_course_id=3884&from_course_list_url=course_index

交通大學駭客書院 -     高階網頁滲透測試 6/13 6/20
https://hackercollege.nctu.edu.tw/?p=1161

交通大學駭客書院 -     企業網域控管-Active Directory攻擊與防禦 6/27
https://hackercollege.nctu.edu.tw/?p=1164

CYBERSEC 2020 臺灣資安大會 8/12
https://cyber.ithome.com.tw/


沒有留言:

張貼留言

資安事件新聞週報 2020/8/3 ~ 2020/8/7

              資安事件新聞週報 2020/8/3  ~  2020/8/7 1.重大弱點漏洞/後門/Exploit/Zero Day D-Link DIR-816L命令注入漏洞 http://cve.mitre.org/cgi-bin/cvename.cgi?na...